User Site Permissions

[rudolcas]

Hello There,

How do I give a "certain user" site permissions? This is needed for important security reasons, within our company, since we have global offices.

Thank you,
Rudy

[rudolcas]

Does anybody know this answer?

I need certain admin-users to manage certain sites and not give everyone an open-door of information to every admin. All about constraints/security.

[abhi1693]

Then you should drop their permission level from admin and provide them object based permissions.

Any superuser will also bypass any permission you assign to them.

[rudolcas]

Wait that doesn't make sense.

I just need to assign the individual to that site + components/all objects of that site only.

[rudolcas]

Anybody has an answer to give site-only permissions to a user?

[Snarf42]

Have a look here

https://docs.netbox.dev/en/stable/getting-started/planning/

and

https://docs.netbox.dev/en/stable/administration/permissions/

It is easier to limit access based on tenancy instead of sites.

[rudolcas]

I added this to JSON permission:

{"status": "active", "region__name": "Asia_Pacific"}

##########################
Error Output:

Invalid filter for <class 'dcim.models.devices.Device'>: Cannot resolve keyword 'region' into field. Choices are: _name, airflow, asset_tag, cabletermination, cluster, cluster_id, comments, consoleports, consoleserverports, contacts, created, custom_field_data, description, device_role, device_role_id, device_type, device_type_id, devicebays, face, frontports, id, images, interfaces, inventoryitems, journal_entries, last_updated, local_context_data, location, location_id, modulebays, modules, name, parent_bay, platform, platform_id, position, poweroutlets, powerports, primary_ip4, primary_ip4_id, primary_ip6, primary_ip6_id, rack, rack_id, rearports, serial, services, site, site_id, status, tagged_items, tags, tenant, tenant_id, vc_master_for, vc_position, vc_priority, vdcs, virtual_chassis, virtual_chassis_id, virtual_machines

[candlerb]

Device doesn't have a "region" attribute; it's an attribute of Site. You would need site__region__name

[rudolcas]

OK I think I have understood now.

1. Every 'OBJECT TYPES' needs to be looked at and considered in its settings.
2. Written out CONSTRAINTS [JSON] - correlates to ALL the OBJECT TYPEs chosen.
3. So the amount of written out constraints [multiple lines of constraint code] should REFLECT to all the Object Types selected in order not to produce an ERROR /or for the ERROR to disappear.